Document that BPF JIT not enabled by default

[mjsabby]

/proc/sys/net/core/bpf_jit_enable is 0 on a default installation. This is probably intentional, putting a note in the kernel protections would be informative to the user.

[christopherco]

bpf_jit_enable is actually expected to be 1 (enabled) in the general case. Our standard kernel sets CONFIG_BPF_JIT_ALWAYS_ON=y.

However, there is a case where if one installs CBL-Mariner via ISO on a HyperV VM, the installed image would have our HyperV-tuned kernel instead of the "standard" kernel. The HyperV-tuned kernel currently has bpf disabled by default. I suspect you ran into this case.

Since the HyperV kernel is still under evaluation, I have made a change to have the ISO install the standard kernel in all of its current profiles.

[mjsabby]

Thanks @christopherco, that's exactly what happened.

[WSLUser]

However, there is a case where if one installs CBL-Mariner via ISO on a HyperV VM, the installed image would have our HyperV-tuned kernel instead of the "standard" kernel.

Source?
Any consideration in simply forking https://github.com/clearlinux-pkgs/linux-hyperv and then adding/removing whatever config options you want? I think you'll want majority of them but I see PRs like #136, which I know isn't enabled in their config.

[PawelWMS]

@WSLUser: the kernel configuration being installed from the ISO is set through the "KernelOptions" field inside the config file. @christopherco is currently modifying the sample configs inside #132 in case you're curious.

[jslobodzian]

The Hyper-V Kernel is no longer a supported option in the ISO. Closing this issue as-designed.